Which versions of Nexus Repository 3 are affected by CVE-2026-17600?

Sonatype Nexus Repository 3 contains a session persistence vulnerability allowing previously-authenticated users to retain full repository access after administrative account revocation or deletion,…. A patch is available.

How to fix or mitigate CVE-2026-17600?

Within 24 hours, identify all Nexus Repository 3 instances and review current configurations for maximum session timeout limits. Within 7 days, apply the vendor-released patch to all affected instances and immediately invalidate all active user sessions to force re-authentication. Within 30 days, conduct a retrospective audit of repository access logs to identify any suspicious activity from revoked accounts during the patching window and implement session timeout limits of no more than 4 hours for standard users.

Nexus Repository 3 CVE-2026-17600

Q: What is the CVSS score of CVE-2026-17600?

CVE-2026-17600 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-54515 HIGH

Insufficient Session Expiration (CWE-613)

2026-08-07 Sonatype

GHSA-9pmx-p77j-955r

Authentication Bypass Nexus Repository 3 Sonatype

8.7

CVSS 4.0 · Vendor: Sonatype

Severity by source

Vendor (Sonatype) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible with no special conditions; requires low privileges (pre-existing session); full C/I/A impact within the repository system; no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Sonatype).

CVSS VectorVendor: Sonatype

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 16:47 vuln.today

CVE Published

Aug 07, 2026 - 16:07 cve.org

HIGH 8.7

DescriptionCVE.org

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

AnalysisAI

Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full repository access after their account is deleted, deactivated, or their password is changed. Any user holding an active session at the moment of an administrative revocation event can continue reading, modifying, or deleting repository content until that session naturally times out - bypassing the intended access control action. No public exploit has been identified and this is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects the high-impact triad of confidentiality, integrity, and availability against network-accessible repositories once the prerequisite session exists.

Technical ContextAI

CWE-613 (Insufficient Session Expiration) describes the root cause: the server-side session store or permission cache is not forcibly invalidated when the underlying account state changes. In Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*), session tokens or cached authorization grants apparently remain valid for their full configured lifetime regardless of account deletion, deactivation, or credential rotation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the application is network-accessible with no special attack conditions - the only pre-requisite is that a low-privilege session was legitimately established before the revocation event. This class of flaw is particularly impactful in artifact repository platforms because sessions tend to be long-lived to support CI/CD tooling and automated pipelines.

RemediationAI

Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, as documented in the vendor release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html and the support advisory at https://support.sonatype.com/hc/en-us/articles/53888843674003/. As an immediate compensating control prior to patching, administrators who have recently deleted, deactivated, or rotated passwords for sensitive accounts should force-expire active sessions via the Nexus administrative interface (Admin > Security > Sessions) if the version supports it, or restart the Nexus service to flush all in-memory session state - noting that a restart will briefly interrupt all active repository clients including CI/CD pipelines. Additionally, reducing the configured session timeout to a shorter value limits the residual exposure window for any sessions that cannot be individually terminated.